feat(yearn): monitor small parent vault deposits

automation/jobs.yaml

@@ -61,6 +61,7 @@ profiles:
       - { name: "stables-oracles",         script: protocols/stables/oracles.py }
       - { name: "cap-status",              script: protocols/cap/status.py }
       - { name: "yearn-alert-large-flows", script: protocols/yearn/alert_large_flows.py }
+      - { name: "yearn-alert-small-parent-flows", script: protocols/yearn/alert_small_parent_flows.py }
       # Cache: tks-trigger-cache.json under $CACHE_DIR (check_stuck_triggers.DEFAULT_CACHE_FILE).
       - { name: "yearn-check-stuck-triggers", script: protocols/yearn/check_stuck_triggers.py, enabled: false }
       - { name: "maple",                  script: protocols/maple/main.py, enabled: false }

monitoring.yaml

@@ -460,6 +460,7 @@ protocols:
     tasks:
       - protocols/yearn/lender_borrower.py
       - protocols/yearn/alert_large_flows.py
+      - protocols/yearn/alert_small_parent_flows.py
       - protocols/yearn/check_timelock_delay.py
       - protocols/yearn/check_indexer_freshness.py
     monitors:
@@ -470,6 +471,8 @@ protocols:
         severity: "MEDIUM"
       - name: "Large Flows"
         description: "Deposit/withdrawal flows >=$500k USD (Katana withdrawals >=$50k; or 10% of vault totalSupply fallback for unpriced tokens)"
+      - name: "Small Parent Vault Flows"
+        description: "Individual deposits and withdrawals with a raw ERC-4626 assets value below 10,000 for active Yearn v3 parent vaults"
       - name: "Timelock Delay"
         description: "Yearn TimelockController getMinDelay() < 7 days across Mainnet, Base, Arbitrum, Polygon, Optimism, Katana"
       - name: "Timelock Events"

protocols/yearn/README.md

@@ -55,6 +55,31 @@ Optional flags:
 - `--chain-ids` (default: all vault chain IDs — `1,8453,42161,747474`)
 - `--no-cache` (disable caching)
 
+## Small Parent Vault Flows
+
+The script `yearn/alert_small_parent_flows.py` alerts on every deposit or withdrawal whose raw ERC-4626 `assets` value is strictly between 0 and 10,000 for an active Yearn v3 parent vault. The comparison happens before decimal normalization: 10,000 raw units equals 0.01 USDC, 0.0001 WBTC, or 0.00000000000001 WETH.
+
+### Data Sources
+
+- **Parent vault discovery**: Kong GraphQL, filtered to Yearn v3 `vaultType: 1` vaults and excluding retired or hidden entries.
+- **Flow events**: Envio `Deposit` and `Withdraw` entities. Alerts include the ERC-4626 owner and sender, the transaction initiator, and the asset receiver for withdrawals.
+- **Token decimals**: the parent vault's underlying asset metadata from Kong, used only to show a human-readable amount alongside the raw value.
+
+Deposits and withdrawals are processed with independent per-chain `(blockNumber, logIndex)` cursors stored in the monitoring database. A cursor advances only after an event is successfully evaluated and, when applicable, delivered to Telegram. A new deployment starts each stream with a two-hour lookback.
+
+### Usage
+
+```bash
+uv run protocols/yearn/alert_small_parent_flows.py
+```
+
+Optional flags:
+
+- `--threshold-raw` (default: `10000`)
+- `--lookback-seconds` (default: `7200`, used only before a chain cursor exists)
+- `--page-size` (default: `1000`)
+- `--chain-ids` (default: `1,10,8453,42161,137,747474`)
+
 =======
 
 ## Shadow Debt Check